Privacy Policy

This Privacy Policy explains how MIKAVO ("MIKAVO", "we", "us") collects, uses, and protects information when you use the MIKAVO mobile app (iOS and Android) or visit the MIKAVO website, together the "Service". MIKAVO is operated by an individual developer, referred to here as the data controller, reachable at Michal.Doroz@mikavo.eu.

Account information. When you create an account, we collect your email address and password (handled securely by Firebase Authentication — we never see your plain-text password), or, if you sign in with Google or Apple, the name, email address, and profile photo shared by that provider.

Training data you provide. Everything you log to use the app's core features: workouts and workout history, sets, reps, and weights, exercises (including custom exercises you create), training plans and progression settings, workout templates, body measurements, and goals and achievement progress. This data is the reason the app exists, and it is never sold.

Purchase and subscription information. If you subscribe to Premium, Apple's App Store or Google Play processes your payment directly — MIKAVO never receives or stores your card details. We (and our subscription-management provider, RevenueCat, where used) receive your subscription status and entitlement information, so the app knows which features to unlock.

Website usage data. As of this policy's effective date, the MIKAVO website does not set analytics or advertising cookies. If we add analytics in the future, we will update this section and request consent through a cookie banner where required by law before any non-essential cookie is set.

Diagnostic information. Basic technical information (device type, operating system version, app version, crash logs) may be collected automatically to keep the app stable and secure.

• To provide and operate the app's features and keep your data in sync across your devices via your account.
• To calculate progression, statistics, analytics, and achievements from the training data you log.
• To process and manage your Premium subscription and verify your entitlement to Premium features.
• To maintain, secure, and improve the Service, including diagnosing and fixing bugs.
• To respond to support requests you send us.
• To comply with legal obligations we're subject to.

Where the GDPR applies, we process your data under one of these legal bases: performance of a contract (providing the core app functionality you sign up for), legitimate interest (keeping the Service secure, functioning, and improving it), and consent (for anything not covered above, such as future optional analytics cookies on the Website, which you can withdraw at any time).

We do not sell your personal data. We share it only with the service providers ("sub-processors") that MIKAVO itself runs on, strictly to operate the Service:

• Google Firebase (Authentication, Cloud Firestore database, and, where enabled, Firebase Analytics) — hosts your account and training data and provides sign-in.
• Google Sign-In / Sign in with Apple — only if you choose to sign in with those providers.
• Apple App Store / Google Play — process app purchases and subscriptions under their own privacy policies.
• RevenueCat — subscription and entitlement management, where integrated.

We may also disclose information if required by law, or to protect the rights, safety, or property of MIKAVO or its users.

Our infrastructure providers (principally Google Firebase) may process and store data on servers located outside your country, including outside the European Economic Area. Where this happens, it relies on the transfer safeguards those providers maintain, such as the EU Standard Contractual Clauses.

We keep your account and training data for as long as your account is active. Deleting your account from within the app (Settings → Delete Account) removes your account and training data from our active database immediately — this action is irreversible. Residual copies may briefly persist in infrastructure-level backups maintained by our hosting provider before being overwritten in the normal course of business.

If the GDPR applies to you, you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority — in Poland, the Prezes Urzędu Ochrony Danych Osobowych (UODO). If you're located elsewhere, you may have similar or additional rights under your local law.

Some of these — exporting your history, deleting your account — are available directly in the app's account settings. For anything else, email Michal.Doroz@mikavo.eu with "Privacy Request" in the subject line; we aim to respond within 30 days.

MIKAVO is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We use reasonable technical and organizational measures to protect your data, including encryption in transit and access-controlled cloud infrastructure (Firebase security rules that restrict every account's data to that account alone). No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

The training and body-measurement data you log is used only to power the app's own features (progression, analytics, achievements). It is not reviewed by a medical professional and is not used to provide medical advice or diagnosis — see the Terms of Service for our full health & fitness disclaimer.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you in the app or by email before the change takes effect.

Questions about this policy or your data? Email Michal.Doroz@mikavo.eu.